Redundant hardware architecture for the control signal stage of the braking system of a vehicle in which each of the wheels are connected to at least one rotary electrical machine

ABSTRACT

An electric braking system is provided for a road vehicle that includes at least one wheel connected for rotation to at least one rotary electric machine. At least one electronic wheel control module controls an electric machine of a corresponding wheel, The electric braking system includes: a central unit ( 3 ) for ensuring management of a vehicle displacement, the central unit controlling the at least one electronic wheel control module ( 23 ); a braking control available to a driver, the braking control being connected mechanically to at least: a first sensor (C 1 ) outputting a vehicle braking control signal having a given amplitude representing a total braking force desired for the vehicle, and a second sensor (C 2 ) outputting a vehicle braking control signal having a given amplitude representing the total braking force desired for the vehicle. The first sensor (C 1 ) outputs its control signal to the central unit ( 3 ) and the second sensor (C 2 ) outputs its control signal to one or each of the at least one electronic wheel control module ( 23 ).

FIELD OF THE INVENTION

The present invention relates to road vehicles. It relates in particularto the braking systems of a road vehicle using electric traction.

Electric vehicles include vehicles in which the electrical energynecessary for displacement thereof is stored in batteries and vehiclesin which the electrical energy is produced on board, by a thermal enginedriving a generator or by a fuel cell. Traction of the vehicle isensured by one or more electric machines. Braking of the vehicle isensured by a conventional mechanical braking system. Numerouselectrically powered vehicles have already been proposed in the priorart. Mention may, for example, be made of U.S. Pat. No. 5,418,437 whichdescribes a four-wheeled vehicle of series hybrid type, each wheel beingdriven by its own electrical machine, a controller controlling the wheelmotors and managing the supply of power to the motors from an alternatorof a battery. That patent makes no mention regarding the management ofelectrical braking.

However, since an electric machine is reversible, it may also be used asan electric generator during the vehicle braking phases and in this caseit converts the mechanical braking energy into electrical energy whichthe vehicle has to absorb, optionally by thermal dissipation. Thisoperating mode is often called “electric braking” or “regenerativebraking”.

In practice, electric machines function as generators so as to ensuremoderate deceleration of the vehicle, to recover the energy as far aspossible and store it in electrical accumulators, or indeed to dissipateit in order to reduce the stress suffered by the mechanical brakes ofthe vehicle. The main braking of a vehicle is ensured in effect byhydraulically controlled mechanical brakes, generally in assistedmanner, and these days most frequently provided with an anti-lockfunction commonly known as “ABS”. Braking is a crucial vehicle safetyfunction. Mechanical brakes have considerable power, sufficient to causea wheel to lock, the power being limited by the anti-lock function, inassociation with maximum grip. To ensure passenger safety, the brakingsystem of a passenger vehicle is generally capable of ensuringdeceleration of the order of 1 “g”, g being the unit of acceleration forwhich the value “1” corresponds to the earth's gravity.

Furthermore, in an electric traction vehicle, it is particularlyworthwhile incorporating the electric machine in the wheel, because thisdoes away with mechanical shafts and offers greater latitude with regardto the general architecture of the vehicle. A plurality of arrangementsfor incorporating electric machines into wheels are known from the priorart. International (PCT) patent application publication WO 2003/065546proposes arranging four electric machines transmitting their torque tothe wheel by means of a planetary gear train. European patentapplication publication EP 0878332 discloses a ground contact systemwhich incorporates both the vertical suspension of the wheel within thelatter and a rotary electric traction machine. There is a reductionstage between the wheel and the electric machine, the latter beingmeshed with a toothed wheel coaxial with the wheel. Of course, the wheelcomprises a disc brake so as to ensure the service braking function.Furthermore, the ground contact system comprises a pivot so as to allowturning of the wheel. All the mechanical functions of a ground contactsystem are thus incorporated into the wheel.

Because operating safely is of the utmost importance, numerous systemsfor controlling traditional mechanical brakes have been proposed, suchas the one in European patent application publication EP 1 026 060 whichdescribes redundant means, majority decision control, a plurality oflow-voltage supplies to the control systems in order to maintain fulloperability even if a number of batteries fail. Mention should also bemade of U.S. Pat. No. 6,244,675 which describes a brake control theposition of which is measured by three sensors, powered by twoindependent sources: one sensor is supplied by a first source, anotherby a second source and the third by both sources via diodes; if one ofthe sources is out of action, two sensors are still supplied with powerand remain operational.

The invention relates to electric braking systems for road vehiclesequipped with wheels which are each connected for rotation to at leastone rotary electric machine, each rotary electric machine cooperatingwith a single wheel. With such an architecture, it is possible to givethe electric braking system a predominant role, with regard both topower and to control of vehicle stability (functions known as ABS andESP) since it is possible to control selectively the wheel torque ateach of the wheels via the control system of the rotary electricmachine(s) associated therewith. For this purpose electric braking mustalso be extremely reliable.

The object of the present invention is to improve the reliability ofelectric braking systems for electric traction vehicles. In particular,the object is to propose an architecture for an electric braking systemwhich makes it possible to eliminate the mechanical brakes and to ensurethe service braking function solely electrically.

BRIEF DESCRIPTION OF THE INVENTION

A braking system is described below, in which it is possible todistinguish:

-   -   a power stage in which flow the electrical power necessary for        traction and the electrical power generated by electric braking,    -   a low-voltage electrical supply stage for supplying electronics        for controlling and driving power elements, and    -   a flow stage for the signals for controlling vehicle braking.

An architecture is proposed below in which each of these stages exhibitsa certain level of redundancy. The proposed redundancies for each of thestages may each be used alone or in combination with another. Of course,the level of reliability is raised by adding together all the proposedredundancies.

The present application deals as a matter of priority with the flowstage for the vehicle braking control signals. The invention proposes anelectric braking system for a road vehicle, of which at least one wheelis connected for rotation to at least one rotary electric machine, atleast one electronic wheel control module controlling the electricmachine(s) of one and the same wheel, comprising a central unit ensuringmanagement of vehicle displacement, the central unit controlling theelectronic wheel control module(s), comprising a braking controlavailable to a driver, the control being connected mechanically at leastto a first sensor outputting a vehicle braking control signal having agiven amplitude representing the total braking force desired for thevehicle, and to a second sensor outputting a vehicle braking controlsignal having a given amplitude representing the total braking forcedesired for the vehicle, in which system the first sensor outputs itscontrol signal to the central unit and the second sensor outputs itscontrol signal to the electronic wheel control module or to each of theelectronic wheel control modules.

Preferably, the system according to the invention comprises at least twosub-systems each comprising at least one electronic wheel controlmodule, and a low-voltage electrical supply stage for supplyingelectronics controlling and driving the power elements, the low-voltageelectrical supply stage comprising a first supply and at least onesecond supply, the first supply and the second supply beinginterconnected by an electric line comprising a first section and asecond section, the first and second sections being connected by adevice that electrically separates the two sections, capable ofinterrupting the interconnection on demand in the event of one of themexperiencing an undervoltage or an overcurrent, the first sensor beingsupplied by the same section as the central unit, the second sensorbeing supplied both by wheel control electronics of one of thesub-systems and by wheel control electronics of the other of thesub-systems via a pair of diodes isolating the supplies.

Furthermore, at the level of the power stage, a plurality of rotaryelectric machines are used, at least two and preferably one per drivingwheel, this already providing a certain level of redundancy. Preferably,the system according to the invention comprises at least one electronicdissipation module for each of the sub-systems, one of the electronicdissipation modules being supplied by the first section and the other ofthe electronic dissipation modules being supplied by the second section.The dissipation installation comprises for example an electricaldissipation resistor associated with each of the electronic dissipationmodules, in order always to offer a certain deceleration capacity in theevent of breakdown of a resistor or its control module.

In one embodiment for a four-wheeled vehicle, preferably each of thewheels is mechanically connected to its own rotary electric machine(s),each of the sub-systems comprising two of the wheels. Preferably, eachsub-system groups together the wheels of the vehicle disposed diagonallyat opposite corners of the vehicle. It will be seen that this solutionoffers greater safety than the double hydraulic braking circuitscommonly used in motor vehicles.

Furthermore, very advantageously, the low-voltage electrical supplystage for supplying electronics for controlling and driving powerelements comprises two independent voltage sources. The low-voltageelectrical supply stage comprises a first supply and at least one secondsupply, the first supply and the second supply being interconnected by alow-voltage electric line comprising a first section and a secondsection, the first and second sections being connected by a device thatelectrically separates the two sections, capable of interrupting theinterconnection on demand in the event of one of them experiencing anundervoltage, each electronic wheel control module and electronicdissipation module of one of the sub-systems being supplied by the firstsection and each electronic wheel control module and electronicdissipation module of the other of the sub-systems being supplied by thesecond section.

The first supply consists for example of a voltage converter connectedto the central electric line. The electrical energy on this central linemay originate either from a main source, such as for example a fuelcell, or from an electrical energy storage device, or from brakingenergy reused in real time. There is thus also a redundancy of energysources. The second supply consists for example of a low-voltagebattery, dedicated to this low-voltage electrical supply. Of course, itis possible to use for this second voltage source a second voltageconverter itself also connected to the central line or alternativelydirectly to the storage bank.

Finally, the vehicle braking control signal flow stage is constructedaround two sensors connected mechanically, and preferably separately, toa braking control at the disposal of a driver, the sensors beingexploited in a totally different manner as explained below.

It should also be pointed out that, preferably, to keep the vehicleimmobile, a mechanical brake device is installed which is commonly knownas a parking brake. However, such a device is not designed for brakingthe vehicle but only for keeping it stopped, preferably even on veryconsiderable slopes. Thus, the system according to the inventioncomprises, associated with one wheel at least, a mechanical wheelbraking device controlled solely by a parking brake control. Preferably,the parking brake device is controlled by an electrical actuatorcontrolled by a braking control unit which can only be activated below alongitudinal speed threshold of the vehicle, the threshold being forexample less than 10 km/h.

BRIEF DESCRIPTION OF THE FIGURES

Other objectives and advantages of the invention will become clearlyapparent from the description which follows of a preferred butnon-limiting embodiment, illustrated by the following Figures, in which:

FIG. 1 is a schematic representation of a braking system of afour-wheeled vehicle, with on-board electrical energy production;

FIG. 2 is a diagram detailing the power level organised to exhibit acertain hardware redundancy;

FIG. 3 details the low-voltage electrical supply level of the variouscontrol electronics;

FIG. 4 details the level of the control lines between the controlelectronics of the various elements and the central unit.

DESCRIPTIONS OF EMBODIMENTS OF THE INVENTION

FIG. 1 is a schematic representation of a vehicle with four wheels 1_(FrL), 1 _(FrR), 1 _(ReL) and 1 _(ReR). The wheels are designated 1_(FrL) for the left-hand front wheel, 1 _(FrR) for the right-hand frontwheel, 1 _(ReL) for the left-hand rear wheel and 1 _(ReR) for theright-hand rear wheel. Each wheel is equipped with an electric machinewhich is coupled mechanically thereto. The electric machines 2 _(FrL), 2_(FrR), 2 _(ReL) and 2 _(ReR) are shown. Below, the suffixesspecifically denoting the position of the wheel 1 or of the electricmachine 2 in the vehicle will be used only if they contribute somethingto the clarity of the explanation. The electric traction machines 2 arethree-phase synchronous machines, equipped with an angular positionsensor of the resolver type, and are controlled by the electronic wheelcontrol modules 23 to which they are connected by electrical power lines21. The electronic wheel control modules 23 are designed to control theelectric machines with regard to torque. Each electronic wheel controlmodule 23 is able selectively to apply to the relevant wheel a controltorque of determined magnitude and sign. As a result, the electricmachines may be used as motors and as generators. Each of the rearwheels 1 _(ReL) and 1 _(ReR) is additionally equipped with a mechanicalbraking device 71 for the wheel controlled by an electrical actuator 7controlled by a braking control unit.

In one particularly advantageous embodiment of the invention, none ofthe wheels of the vehicle comprises a mechanical service brake. Whateverthe amplitude of the braking control signal, i.e. even for the mostintense braking, braking is ensured purely electrically, i.e. by usingthe electric machines as generators. Each wheel comprises one or morededicated electric machines so as to be able to generate a braking forceselectively on each wheel, which could not be done with an electricmachine common to a plurality of wheels, for example the wheels on oneaxle, because in this case there would be a mechanical transmission anda differential between the wheels. The electric machines are suitablydimensioned to impart to each wheel the greatest possible braking force.

Of course, the system comprises means capable of absorbing elevatedelectrical power, which for example leads to the installation of one ormore electrical dissipation resistors which are cooled effectively, forexample by water circulation, the known electrical accumulators notbeing capable of absorbing the electrical power produced by emergencybraking or not being capable of absorbing all the electrical energyproduced by prolonged braking, unless the installed capacity is suchthat it would make the weight of the vehicle truly prohibitive. Thus,the invention makes it possible to form a self-contained electricalsystem isolated from the environment, with no exchange of electricalpower with the outside of the vehicle, which can therefore also beapplied to motor vehicles, an electric braking system application thatis far more difficult than in the case of vehicles connected to anelectrical network, such as trains or urban trams.

Numerous arrangements are possible for arranging an electric machinecoupled mechanically to the wheel. It should be noted, however, that itis advantageous to provide quite considerable gearing down, for exampleat least equal to 10 and indeed preferably greater than 15, so that theelectric machine is not too bulky. It is possible to install an electricmachine coaxially with the wheel, the mechanical link being ensured by aplanetary gear train to provide the necessary gearing down. It is alsopossible to adopt a configuration of the type described in Europeanpatent application publication EP 0878332, preferably by adding amechanical gearing down stage. It is also possible to choose to providea plurality of electric machines, the torques of which are addedtogether. In this case, an electronic wheel module may control inparallel a plurality of electric machines installed in one and the samewheel. With regard to the installation of a plurality of electricmachines in one wheel, it is possible to consult, for example,international (PCT) patent application publication WO 2003/065546 andFrench patent application publication FR 2776966.

The invention is illustrated as applied to a vehicle ensuring on-boardproduction of electrical energy. A fuel cell 4 is illustrated whichsupplies an electric current over a central electric line 40. Of course,any other means of supplying electrical energy may be used, such as forexample batteries. Also shown is an electrical energy storage deviceconsisting in this example of a bank of supercapacitors 5, connected tothe central electric line 40 by an electronic regeneration module 50. Anelectrical dissipation resistor 6 is shown, preferably immersed in aheat-transfer liquid dissipating the heat towards an exchanger (notshown), constituting an energy absorption device capable of absorbingthe electrical energy produced by all the electric machines duringbraking. The dissipation resistor 6 is connected to the central electricline 40 by an electronic dissipation module 60.

A central unit 3 manages various functions, including the vehicle'selectric traction system. The central unit 3 interacts with all theelectronic wheel control modules 23 as well as with the electronicregeneration module 50 via the electric lines 30A (CAN Bus®). Thecentral unit 3 also interacts with an acceleration control 33 via anelectric line 30E, with a braking control 32 (service brakes) via anelectric line 30F, and with a control 31 selecting forward or reversetravel via an electric line 30C. This makes it possible to take accountof the intentions of the driver. The central unit 3 also interacts witha longitudinal acceleration sensor 34 via an electric line 30D. Finally,the electronic regeneration module 50 interacts with the electronicdissipation module 60 via an electric line 30B.

The central unit 3 ensures management of vehicle longitudinaldisplacement. The central unit 3 controls all of the electronic wheelcontrol modules 23. The central unit 3 has a vehicle braking operatingmode activated by a vehicle braking control signal of given amplituderepresentative of the total braking force desired for the vehicle. Inbraking mode, whatever the amplitude of the braking control signal, thecentral unit 3 controls all of the electronic wheel control modules 23in such a way that the sum of the longitudinal forces of all of thewheels 1 originating from the rotary electric machines is a function ofthe amplitude of the braking control signal. In other words, there is nomechanical service brake; the electric braking system described here isthe service brake for the vehicle

Also shown is a parking brake control 35. The actuator 7 of themechanical wheel braking device is controlled via an electric line 30Hsolely by this parking brake control 35, and absolutely not by thebraking control 32. Preferably, in order to avoid any deterioration ofthe mechanical braking devices 71 designed solely to keep the vehicleimmobile and whose capacity for dissipating heat is thus very limited,the parking brake control unit can only be activated below quite a lowlongitudinal speed threshold of the vehicle, for example lower than 10km/h.

There will now follow an explanation of operation of the systemaccording to the invention.

When the driver selects forward travel using the control 31 and actuatesthe accelerator pedal 33, the central unit 3 instructs the electronicwheel control modules 23 to supply the electric machines 2 by drawingelectrical energy from the central electric line 40. The latter issupplied by the fuel cell 4 and/or the bank of supercapacitors 5,depending on the state of charge thereof and under the control of thecentral unit 3. The vehicle moves forwards. The electric machines 2convert the electrical energy into mechanical traction energy. The powerused depends in particular on the position of the acceleration control33.

When the driver actuates the brake pedal 32, the central unit 3 passesinto braking mode. From the driver's action on the brake pedal 32, thecentral unit 3 calculates a value for the braking control signal.Whatever the amplitude of the braking control signal, the central unit 3controls all of the electronic wheel control modules 23 in such a waythat the sum of the longitudinal forces of all the wheels 1 isproportional to the amplitude of the braking control signal. The rotaryelectric machines 2 then convert mechanical rotation energy intoelectrical energy.

Depending on the management strategy for the electrical energyprogrammed in the electronic regeneration module 50, the latterdistributes the braking energy so as to recharge the bank ofsupercapacitors 5 and/or controls the electronic dissipation module 60so as to dissipate the energy in the electrical dissipation resistor 6.It will be readily understood that, when the storage means such as thebank of supercapacitors 5 are saturated, the entirety of the energy mustbe dissipated. Furthermore, the power of the storage means may belimited, that is to say the charging speed of the storage means may forexample correspond to light braking, as is commonly expected of athermal engine (known as the “engine brake”). Beyond this level ofbraking, the electrical power produced is then directed towards thedissipation means.

In order to ensure operating safety of the vehicle, the electricaldissipation resistor 6 is dimensioned and cooled in such a way that theentirety of the electrical energy produced during emergency brakingoperations, which are the most violent, may be dissipated. In fact, itis advisable to design the system consisting of the rotary electricmachines 2, the electronic wheel control modules 23, the centralelectric line 40, the electronic dissipation module 60 and theelectrical dissipation resistor 6 according to criteria of similarstringency to those applied to mechanical braking systems.

Preferably, all the electrical dissipation resistors 6 form an energyabsorption device of a power greater than 500 kW per tonne of vehicle.In effect, if F is the force applied to the vehicle to brake it, if itsmass is M kg and its speed is V m/sec and if γ is the acceleration inm/sec2, the result is F=M*γ and P=F*V=M*(γ*V); assuming that maximumdeceleration is 1 g, at 130 km/h the power per tonne of vehicle isapproximately 350 kW and at 160 km/h it is approximately 500 kW. Theperson skilled in the art will readily proportion the power of theenergy absorption device as a function of the characteristics of thevehicle which he/she intends to construct.

Thus, as in the example illustrating the invention, there are twosub-systems each having an electrical dissipation resistor, each ofthese electrical dissipation resistors 6A and 6B being of a powergreater than 250*M/1000 kW.

When the driver selects reverse travel, the central unit 3 instructs theelectronic wheel control modules 23 to reverse operation of the rotaryelectric machines 2, including in the event of braking.

A description will now follow of how it is possible to establish ananti-wheel-lock function.

Since the electrical traction machines 2 are equipped with an angularposition sensor of the resolver type, and each wheel 1 has its ownrotary electric machine 2, a rotational speed sensor is thus providedfor each wheel. It is thus advantageously possible to equip the systemaccording to the invention with a device for controlling the slip ofeach wheel, in which, in braking mode (or even as soon as the driverlifts his foot off the accelerator pedal in order to instigate what iscommonly known as “engine braking”), the control torque of a wheel isreduced when the slip control device detects slip of the wheel inquestion. It is possible, for example, to analyse in real time thesignal which the rotational speed sensor of each wheel outputs and todeduce from a marked variation (deceleration) the beginnings of locking.It is possible to calculate in real time the derivative of therotational speed signal of each wheel, thus to obtain a signalrepresentative of the acceleration/deceleration of each wheel and tocompare the latter with a signal giving the realacceleration/deceleration of the vehicle if an appropriate sensor isavailable. This is the longitudinal acceleration sensor 34 alreadyintroduced above, or it results from the processing of a plurality ofsignals allowing estimation of the real acceleration/deceleration of thevehicle. Consequently, the central unit 3 may instruct the electronicwheel control modules 23 to reduce the wheel control torque (selectivelyby wheel) when the slip control device detects slip of the wheel inquestion. It should be noted that this reduction in torque may bemanaged directly by the electronic wheel control modules, which mayreact in real time relative to the speed and acceleration measured atthe wheel, the central unit transmitting for example maximum speed andacceleration instructions to be complied with.

In conclusion, it should be pointed out that the absence of aconventional braking member (c.f. disc and calipers in European patentapplication publication EP 0878332) substantially simplifies not onlythe architecture of the vehicle equipped with a system according to theinvention, but also maintenance thereof by eliminating periodicoperations involving replacement of the pads and discs. Among theadvantages achieved by eliminating conventional hydraulic brakingmembers, mention may additionally be made of the elimination of anyresidual friction of the pads (it is known that this friction consumes anot inconsiderable part of the energy necessary for operation of avehicle with conventional braking). Another advantage which may be notedis the elimination of thermal stresses brought about at the groundcontact system by the conventional hydraulic braking members and theelimination of the nuisance associated with the dust produced by wear ofthe pads and of the discs.

The above description is of a traction system for a motor vehicle inwhich none of the wheels is equipped with mechanical brakes. Thedeceleration capacity of the vehicle stems from operating rotaryelectric machines as generators, the latter being designed so as to beable to cause each of the wheels of the vehicle to lock, that is to saythey are capable of providing sufficient braking torque.

The remainder of the description illustrates a particular non-limitingexample which makes it possible to construct a system having sufficienthardware redundancy to be able to ensure a very high level of safety inthe braking system of the vehicle.

It can be seen in FIG. 2 that the electric braking system comprises twosub-systems (A and B) connected to the central electric line 40, each ofthe sub-systems comprising two wheels each connected for rotation to atleast one rotary electric machine 2 specific thereto. The right-handfront wheel and the left-hand rear wheel, or more precisely the rotaryelectric machines 2 and the electronic wheel control modules 23associated therewith, form sub-system A. The left-hand front wheel andthe right-hand rear wheel, or more precisely the rotary electricmachines 2 and the electronic wheel control modules 23 associatedtherewith, form sub-system B. Each sub-system comprises an electricaldissipation resistor 6A or 6B respectively, each supplied by anelectronic dissipation module 60A or 60B respectively.

If the various constituent elements of the traction system are examinedwith regard to the criterion of hardware redundancy, the rotary electricmachines 2 incorporated into the wheels form a system which naturallyexhibits redundancy since each of the wheels has its own electricmachine. The control electronics of these machines, namely theelectronic wheel control modules 23, likewise form a system whichexhibits hardware redundancy since each of these electric machines 2 hasits own control electronics.

During regenerative braking, each of the rotary electric machines 2supplies electrical energy on the electrical power line 40 via theelectronic wheel control modules 23. This energy may either be stored inaccumulators such as the bank of supercapacitors 5 or be dissipated bythe electrical power resistors 6A and 6B. During emergency braking, itis obviously impossible to count on the storage capacity of theaccumulators, because the latter could very well already be at maximumcharge and incapable of absorbing electrical energy. Consequently, theelectrical resistor 6 is a member crucial to operational safety.Likewise, the electrical power line 40 is a crucial element for theoperational safety of a fully electrical vehicle braking system. Variousfailure scenarios will be examined below.

FIG. 2 shows the main source of electrical energy, which, in thisexample of embodiment, is a fuel cell 4. The Figure also shows theaccumulator battery allowing storage of the electrical energy, which, inthis example of embodiment, is a bank of supercapacitors 5 and itselectronic regeneration module 50. Finally, low-voltage electricalsupply of the various electronic modules is ensured on the one hand by avoltage converter 41 allowing conversion of the voltage available on theelectrical power line 40 into low voltage (for example 12 volts) used tosupply the various control electronics, and on the other hand by abattery 42 such as a DC 12 volt battery used conventionally in avehicle.

We have seen that, in order to ensure braking safety, the braking systemis organised into two sub-systems, namely system A grouping together theright-hand front wheel and the left-hand rear wheel and system Bgrouping together the left-hand front wheel and the right-hand rearwheel. Sub-system A is connected to the power line 40 via an overcurrentprotection device 41A. Sub-system B is connected to the power line 40via an overcurrent protection device 41B. Each of the sub-systems thuscomprises its own dissipation resistor 6A, 6B and each has its owncontrol electronics 60A, 60B and is connected to the power line 40 viaan overcurrent protection device 41A, 41B capable of electricallyisolating the sub-system from the central electric line. At the oppositeend to the power line 40, downstream of the device 41A, a section 40A ofelectrical power line is connected to the electronic wheel controlmodule 23 associated with the left-hand rear wheel, to the electronicwheel control module 23 associated with the right-hand front wheel andfinally to the electronic dissipation module 60A associated with thedissipation resistor 6A. The same is true of sub-system B.

In the event of damage to the power line 40 causing a break between theconnection points of the overcurrent protection devices 41A and 41B, twosub-systems, systems A and B, remain which are independent of oneanother and which are each capable of ensuring electric braking of thevehicle. Each of these sub-systems has its own electrical dissipationresistor. Power stage hardware redundancy is thus provided.

The power stage may suffer other failures than a failure on the powerline 40. It is possible, for example, for the section of the power line40A ending at the electronic dissipation module 60A to be interrupted.In this case, the dissipation resistor 6A is out of circuit. Theelectrical power produced by sub-system A during electric braking maypass through the uninterrupted section of the electrical power line 40Aand, via the overcurrent protection device 41A, pass back to the powerline 40 and be channeled, via the power line 40B, towards the electricaldissipation resistor 6B. The electrical dissipation resistor 6B thusbecomes common, in this case, to sub-system A and sub-system B.

Even if the electrical dissipation power available is divided in two, inthis case precisely, the deceleration capacity of the electric brakingsystem remains considerable, being sufficient to ensure emergencybraking. In effect, each of the electrical dissipation resistors 6 isimmersed in a hydraulic cooling circuit. In the event of emergencybraking, the energy produced by electric braking is sufficient to bringthe cooling fluid to boiling point. All the same, as it is transformedinto the vapour phase, the vaporised fluid is immediately replaced bycooling fluid in the liquid phase, which again washes against theresistor and the system continues to exhibit a certain capacity for heatdissipation. Furthermore, the cooling system exhibits a degree oftemperature lag. Experiments performed by the applicant havedemonstrated that, even with this scenario, the electric braking systemremains considerably more powerful and effective than a hydrauliccrosswise braking system such as those used in motor vehicles at thepresent time.

If the electrical power line 40A is interrupted between the electronicwheel control module 23 associated with the right-hand front wheel andthe electronic wheel control module 23 associated with the left-handrear wheel, then in this case the electrical dissipation resistor 6Aremains available for the rotary electric machine 2 associated with theright-hand front wheel when it functions as a generator whereas theelectrical dissipation resistor 6B is available for sub-system B and forthe rotary electric machine 2 associated with the left-hand rear wheel,that is to say one of the rotary electric machines 2 of sub-system A.One 6B of the electrical dissipation resistors will receive higherelectrical power than the other 6A. Operation is not optimal, but theconfiguration is less disadvantageous for the deceleration capacity ofthe vehicle than that explained in the previous paragraph.

If, for any reason, a failure causes opening of the overcurrentprotection device 41A, thus isolating the sub-system A, then in thiscase also the braking capacities of the vehicle remain at maximumbecause the electrical dissipation resistors are each designed so as tobe able, overall, to ensure full deceleration of the vehicle even whenthe electrical energy accumulator, consisting here of the bank ofsupercapacitors 5, is at maximum charge. In this case, the situation isnot one of breakdown of the electric braking system as regards maximumdeceleration capacity. Admittedly, the situation is not optimal asregards general management, since in particular the possibility ofregenerating energy is lost, but this is not detrimental to safety.

If any one of the failures which have just been explained for sub-systemA occurs in sub-system B, for reasons of symmetry, the electric brakingsafety conditions plainly remain identical. In conclusion, by organisingthe power stage in two independent sub-systems, system A and system B,each connected to the central electrical power line 40 of the vehicle byits own overcurrent protection device (devices 41A and 41B) and byequipping each of the sub-systems with its own electrical dissipationresistor, double hardware redundancy is provided, such that it ispossible to ensure excellent safety conditions for electric braking ofthe vehicle.

The dissipation power of the electrical dissipation resistors 6A and 6Bdepends on good operation of the cooling system. In effect, they areimmersed in a heat-transfer fluid. FIG. 3 is a schematic representationof the cooling circuit. It may be seen that the latter comprises 2 pumps8A and 8B and 2 radiators 80A and 80B. The 2 pumps 8A and 8B are mountedin series and each is controlled by its own electric motor 81A and 81Brespectively. Each of these electric motors is controlled by its owncontrol electronics 82A and 82B. The radiators 80A and 80B are mountedin parallel and equipped with valves 83 which make it possible toisolate each of the radiators selectively in the event of leaks in onethereof. On the other hand, the pump and pump actuating motor assemblyis designed in such a way that, if one of the pumps is out of order, theother pump is capable of ensuring a sufficient flow rate for theheat-transfer fluid despite the fact that the other pump is no longerfunctional.

A description will now be provided of the low-voltage electrical supplyof the various control electronics and of the various auxiliaries, withreference to FIG. 3. This Figure shows the electronic dissipationmodules 60A and 60B of the 2 electrical dissipation resistors 6A and 6B,the electronic wheel control modules 23 each associated with one of thefour electric machines 2, and the electronic regeneration module 50associated with the bank of supercapacitors 5. Also shown is the centralunit 3, the control electronics 82A of one of the pumps of the coolingcircuit and the control electronics 82B of the other one of the pumps ofthe cooling circuit. The brake pedal is assumed to be sufficiently safeas a result of its construction and is thus not duplicated. Two positionsensors, C1 and C2, are each associated with the brake pedal and eachsupply a signal representing the command desired by the driver of thevehicle.

The redundancy for low-voltage electrical energy supply is designed asfollows. Since there are provided, on the one hand, a voltage converter41 connected to the electrical power line 40 and supplying a 12 voltdirect voltage and, on the other hand, a battery 42 also supplying a 12volt direct voltage, certain elements will be connected to the voltageconverter 41 and other elements will be connected to the 12 volt batteryas follows. A line 43 ensures interconnection between the voltageconverter 41 and the battery 42. This line 43 comprises a first section43A and a second section 43B, the first and second sections beingconnected via a device 430 that electrically separates the two sectionsin the event of one of them experiencing an undervoltage or anovercurrent. Thus it may be seen that, in the nonlimiting embodimentillustrative of the invention, the two sections 43A and 43B are suppliedat the same voltage. Certain elements are connected to the first section43A, each via an overcurrent protection device 434A. Certain elementsare connected to the section 43B, each via an overcurrent protectiondevice 434B.

For example, to ensure good operation of the pumps of the coolingcircuit, one of the motors 81A is connected to the first section 43A viaits control electronics 82A. The other one of the motors 81B isconnected to the second section 43B via its control electronics 82B. Thecontrol electronics of sub-system A, namely the electronic wheel controlmodule 23 associated with the rotary electric machine 2 of theright-hand front wheel, the electronic wheel control module 23associated with the rotary electric machine 2 of the left-hand rearwheel and the electronic dissipation module 60A of the dissipationresistor 6A are connected to the second section 43B whereas the sameelectronics of sub-system B are connected to the first section 43A.

The central unit 3 ensuring management of vehicle displacement, since itcontrols all the electronic wheel control modules 23, benefits from adouble electrical connection. It is connected both to the first section43A and the second section 43B, via a pair of diodes isolating the firstand second sections. The central unit 3 is connected each time via adiode 435 so as to ensure continuity of electrical supply of the centralunit 3, even in the event of breakdown of one of the 2 low voltagesources. Furthermore, a suitable circuit 436 monitors the presence ofelectrical voltage on each of the supply lines in order to send a faultsignal in the event of breakdown of one of the two electrical supplies.The electronic regeneration module 50 associated with the bank ofsupercapacitors 5 is connected solely to the first section 43A. Itshould be noted that this type of double connection could also be usedfor all the electronics, in particular for the electronic wheel controlmodules 23.

In the event of an undervoltage or of an overcurrent resulting, forexample, from a short circuit in one of the two sections 43A or 43B ordirectly inside one of the supplies 41 or 42, the electrical separationdevice 430 interrupts the connection between the two sections 43A and43B in order to preserve the functionality of the fault-free section. Itmay therefore be seen that if, for some reason, a significant fault withthe voltage converter 41 causes the electrical separation device 430 tointerrupt the interconnection between the voltage converter 41 and thebattery 42, the latter can continue with low-voltage supply of thecontrol electronics associated with sub-system A and the central unit aswell as one of the 2 pumps of the hydraulic cooling circuit. Conversely,in the case of a significant fault at the battery 42, the electricalseparation device 430 can interrupt the interconnection and the voltageconverter 41 can continue to supply sub-system B, the central unit andone of the pumps of the hydraulic cooling circuit. It may thus be seenthat the architecture described makes it possible to maintain operationof one of the 2 sub-systems A or B and thus half of the vehicle brakingpower is still available. Of course, using the double connection of thelow-voltage electronic supply for all the electronics means that fullbraking power can remain available even in this fault scenario.

A description will now follow of supply of the braking sensors C1 andC2, which are the first link in the braking control system. It should beremembered that the system according to the invention comprises acentral unit 3 which controls all of the electronic wheel controlmodules 23. On the other hand, the system according to the inventioncomprises a braking control 32 available to a driver, the control beingconnected mechanically at least to a first sensor C1 outputting avehicle braking control signal having a given amplitude representing thetotal braking force desired for the vehicle, and to a second sensor C2outputting a vehicle braking control signal having a given amplituderepresenting the total braking force desired for the vehicle.

The architecture of the system according to the invention has allotted adifferent role to sensors C1 and C2.

The sensor C1 is supplied with low-voltage electrical energy by thecentral unit 3. It outputs the control signal to the central unit 3 andthe latter receives the braking control signal only from sensor C1 tocreate a first level of overall vehicle braking control signals. Let itbe pointed out that the central unit 3 comprises the appropriatecircuits for monitoring the presence of voltage on the line supplyingthe sensor C1, and the integrity of the control signal on the line 30F,so as to manage fault information concerning a fault on the conditioningcircuit for sensor C1.

The second sensor C2 is supplied by the electronic wheel control modules23 associated with each of the electric machines. The second sensor C2outputs its control signal to each of the electronic wheel controlmodules 23. Of course, a diode 230 is implanted in the supply linebetween each of the control electronics 23 and the sensor C2.Furthermore, a suitable circuit 231, in each of the wheel controlmodules 23, monitors the presence of electrical voltage on each of thefour supply lines in order to send a fault signal in the event ofbreakdown of one of the four electrical supplies. In the followingparagraph it will be seen that sensor C2 is directly associated with thewheel control electronics 23 and solely with the wheel controlelectronics 23.

It has just been seen that the low-voltage electrical supply stagecomprises a first supply and at least one second supply, the firstsupply and the second supply being interconnected by an electric line 43comprising a first section 43A and a second section 43B, the first andsecond sections being connected by a device 430 that electricallyseparates the two sections in the event of one of them experiencing anundervoltage or an overcurrent. The first sensor C1 is supplied by thesame section as the central unit 3 and the second sensor C2 is suppliedboth by wheel control electronics 23 of one (A) of the sub-systems andby wheel control electronics 23 of the other (B) of the sub-systems viaa pair of diodes isolating the supplies.

In FIG. 4, it may be seen that the central unit 3 is interconnected witheach of the electronic wheel control modules 23 and with the electronicregeneration module 50 by a CAN Bus® (Control Area Network, designatedby reference numeral 30A) allowing the transfer of control instructionsin computerised form. The central unit 3 is loaded with softwaresuitable for being able to take into account all the desirableparameters in order to develop a braking control signal which is sent tothe various electronics controlling the electric machines in accordancewith the desired protocols for circulation through the CAN bus 30A. Thecentral unit 3 sends the signal in cadence on the bus 30A with a periodof the order of 10 to 20 ms, and each electronic wheel control module 23monitors this period. If, because of malfunctioning of the CAN bus, ofthe central unit 3, or of the inbuilt software, or for some otherreason, this period changes, a CAN communications fault data item isgenerated. Each of the electronic wheel control modules 23 additionallydirectly receives analogue signals output by the sensor, this time viaanalogue lines 300. Let it also be pointed out that each wheel controlmodule 23 comprises the appropriate circuits for monitoring theintegrity of the control signal on the line 300, so as to manage faultinformation in the event of a fault on the conditioning circuit forsensor C2.

Finally, control lines 30B connect the electronic regeneration module 50to the electronic dissipation modules 60A and 60B. In the event of afault on the control lines 30B or at the electronic regeneration module50, the electronic dissipation modules 60A and 60B retain thepossibility of dissipating the braking power which automatically passesback to the power line 40 without receiving a command on line 30B. Thesub-assemblies A and B thus remain fully operational for braking butwithout the possibility of storing energy, since, in the latterinstance, the electronic regeneration module 50 is out of service.

To return to the creation of braking torques by the electric machines 2,control of the electric machines 2 is ensured directly by an electronicwheel control module 23 specific to each of the electric machines 2. Themodule is loaded with software suitable for controlling each electricmachine with regard to torque depending on the control signals received.Each electronic wheel control module 23 receives braking control signalson the one hand on bus 30A and on the other hand on the analogue line300 supplying the signal from sensor C2. Each electronic wheel controlmodule 23 may thus compare at any moment the control signal supplied onbus 30A and the control signal supplied by the analogue line 300 and,within a certain tolerance margin for example of the order of 10 to 20%depending on what is determined experimentally, give priority to thebraking control signal coming from bus 30A. This is the normal operatingmode.

On the other hand if, due to malfunctioning of the central unit 3 or ofthe software established in the central unit 3, the braking controlsignal sent by the bus 30A was much lower than the braking controlsignal coming directly in analogue manner from sensor C2, priority maybe given to the control signal coming from sensor C2 to ensureoperational safety when braking the vehicle. It can be seen that theproposed architecture utilises differently the signals supplied by eachof sensors C1 and C2. Sensor C1 is associated with the central unit 3and makes it possible to calculate a first level overall braking signal.On the other hand, the control signal supplied by sensor C2 is supplieddirectly in analogue manner by suitable lines to the electronic wheelcontrol modules 23. Overall coherence is ensured by comparing thevarious signals. The signal corresponding to the highest decelerationdemand, within a selected tolerance margin, then takes priority. In thisway, braking control safety is ensured even in the event of breakdown ofthe bus 30A, or of a section of the bus, or of any of the analogue lines300 or 30F.

Finally, if a wheel control electronic module 23 detects a CANcommunications fault, or if the central unit 3 detects a fault with thesensor C1 or with its conditioning circuit, then once again, prioritycan be given to the control signal originating from the sensor C2 inorder to ensure safe vehicle operation under braking.

In addition to all the above, it is possible to establish a possibilityof creating a braking signal predetermined by an emergency command bymeans for example of an emergency button at the disposal of the driver.This type of braking command is taken into account by the central unit3, more precisely by the software established in the central unit 3, andis routed to the control electronics 23 of each of the electric machinesby the CAN bus 30A. This may ensure operating safety during braking evenif the brake pedal breaks off. Likewise, this may ensure operatingsafety during braking in the event of breakage of the 2 sensors orbreakage of the fixing means of the 2 brake sensors C2 and C2. If onlythe mechanical connection of one of the 2 sensors C1 or C2 or one of the2 sensors is faulty, operating safety during braking is of courseensured as explained in the previous paragraph. However, in this case itis possible, for example, to allow the journey to be brought to an endand, once the vehicle has stopped, to prevent it from starting again.

Finally, it should be pointed out that the hardware redundancy which hasjust been explained is preferably used in combination with softwareredundancy, advantageously both with regard to the software loaded inthe central unit 3 and that loaded in the electronic wheel controlmodules 23. In this way, a high degree of safety is achieved for a fullyelectrical vehicle braking system.

The invention claimed is:
 1. An electric braking system for a roadvehicle that includes a plurality of wheels connected for rotation to aplurality of rotary electric machines, respectively, each rotaryelectric machine being controlled by a respective electronic wheelcontrol module connected to the rotary electric machine, the electricbraking system comprising: a central unit, which electronically managesmovement of the vehicle, the central unit controlling the electronicwheel control modules; a braking control device available to a driver ofthe vehicle, the braking control device configured to be actuated by thedriver to indicate a total braking force desired for the vehicle, andthe braking control device being configured to redundantly activate afirst sensor and a second sensor, such that the first sensor outputs afirst vehicle braking control signal having a given amplituderepresenting the total braking force desired for the vehicle, and suchthat the second sensor outputs a second vehicle braking control signalhaving a given amplitude representing the total braking force desiredfor the vehicle; at least two sub-systems, each of the at least twosub-systems including at least one of the electronic wheel controlmodules; and a low-voltage electrical supply stage for supplyingelectronics controlling and driving power elements, the low-voltageelectrical supply stage including a first supply and at least one secondsupply, the first supply and the at least one second supply beinginterconnected by an electric line that includes a first section and asecond section, the first and second sections being connected by adevice that electrically separates the first and second sections, andbeing configured to interrupt an interconnection on demand in an eventof one of the first and second sections experiencing an undervoltage oran overcurrent, wherein the first sensor outputs the first vehiclebraking control signal to the central unit, and the central unit outputsa brake signal to control the electronic wheel control modules, whereinthe second sensor outputs the second vehicle braking control signal tocontrol the electronic wheel control modules, wherein the brake signalfrom the central unit is sufficient by itself to brake the plurality ofwheels according to the total braking force desired for the vehicle whenthe second vehicle braking control signal is absent, wherein the secondvehicle braking control signal is sufficient by itself to brake theplurality of wheels according to the total braking force desired for thevehicle when the first vehicle braking control signal is absent, whereinthe plurality of wheels includes at least one wheel on a left side ofthe vehicle and at least one wheel on the right side of the vehicle, andwherein the first sensor and the central unit are supplied by a same oneof the first and second sections, and the second sensor is supplied bythe electronic wheel control modules of the at least two sub-systems viadiodes isolating the supplies from the electronic wheel control modules.2. An electric braking system according to claim 1, further comprisingan electronic dissipation module for each of the at least twosub-systems, a first of the electronic dissipation modules beingsupplied by the first section, and a second of the electronicdissipation modules being supplied by the second section.
 3. An electricbraking system according to claim 1, wherein the first supply is abattery.
 4. An electric braking system according to claim 1, furthercomprising a central electric line, wherein a supply of the at least onesecond supply includes a voltage converter connected to the centralelectric line.
 5. An electric braking system according to claim 1,wherein the vehicle includes four wheels, each wheel being connected forrotation to a rotary electric machine specific thereto, and wherein eachof the at least two sub-systems includes two of the four wheels.
 6. Anelectric braking system according to claim 5, wherein each of the atleast two sub-system is associated with two of the four wheels of thevehicle disposed diagonally at opposite corners of the vehicle.
 7. Anelectric braking system according to claim 1, wherein the central unitis supplied by both the first section and the second section via a pairof diodes, such that a first of the diodes is attached between thecentral unit and the first section, and such that a second of the diodesis attached between the central unit and the second section.
 8. Anelectric braking system according to claim 2, wherein at least one ofthe electronic dissipation modules is associated with a dissipator. 9.An electric braking system according to claim 8, wherein the vehicle hasa mass of M kg, and wherein the dissipator is of a power greater than250*M/1000 kW per sub-system.